Technical impact
A race condition has been identified within the security control module of Huawei HarmonyOS, which could allow an attacker to manipulate the timing of concurrent operations and cause the affected service to fail or become unavailable. The vulnerability is classified as CWE‑362 and CWE‑840, indicating improper handling of shared resources under concurrent conditions. Successful exploitation could lead to denial of service conditions, interrupting normal device operation.
Affected Systems
The issue is reported for Huawei HarmonyOS version 6.0.0. It is likely relevant to any build that contains the unpatched security control module and has not yet applied the official firmware update.
Risk and Exploitability
The base CVSS score of 4.0 indicates low severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Because the race condition involves shared system resources, the likely attack vector would be local or privileged, requiring an attacker to gain elevated access or force concurrent requests. Overall risk remains low but patching is recommended to prevent service disruption.
